We now evaluate data augmentation as a defense against targeted poisoning attacks. To this end, we use the state-of-the-art method, Witches' Brew [1]}, as well as an “adaptive attack” version in which attacks are generated on networks trained with the same data augmentations as the victim. We train a ResNet-18 on CIFAR-10, and we consider a threat model with \(\ell _\infty \)  bound \(16/255\)  and a budget of \(1\%\) . For all experiments, we consider a baseline model trained with random horizontal flips and random crops. We then compare modern data augmentation against differential-privacy based defenses with a special focus on practical clean validation accuracy, that is “normal” usability of the model. We conduct and average success over 20 runs, where each run consists of a randomly chosen target image and a randomly chosen adversarial label. In each run, a new model is trained from scratch on the poisoned training set and evaluated on the target image. The lower the attack's success rate, the more effective the defense.
